replay: fail closed when the pack carries no usable binding

[inventor1975]

This is the finding reported to Arkadiy on 2026-09-19, with the fix and a regression test.

The problem

veip-verify replay pack.json — the default invocation — could report PASS on a tampered pack.

execution.outcome.result_ref is typed in the schema as {"type": "string", "minLength": 1}, so any string validates. _extract_binding_from_pack() returns None for a string that is not sha256:<64 hex>; verify_integrity_binding() defaulted to require_binding=False; and the CLI set it True only with --require-binding. So overwriting the carrier — the field that protects the pack — turned tamper detection off, and the result read as an ordinary pass.

Reproduction: take tests/fixture_pack.json, change one schema-valid field (policy.policy_version), rewrite result_ref to ref://opaque-store/result-1. The pack still validates.

before:  $ veip-verify replay pack.json
         exit=0  PASS replay: no binding present (not required)

after:   $ veip-verify replay pack.json
         exit=2  FAIL replay: binding carrier is not a sha256 digest:
                 execution.outcome.result_ref = 'ref://opaque-store/result-1'

after:   $ veip-verify replay pack.json --allow-missing-binding
         exit=0  PASS replay: NOT VERIFIED: binding carrier is not a sha256 digest: ...

The integrity check itself is sound — with a genuine binding in place the same tampered pack already fails with binding mismatch. What was missing was that the check could be opted out of by editing one field, silently.

What this changes

Everything is inside the verifier. The schema and the protocol are untouched — result_ref may still legitimately be an opaque pointer rather than a digest, so this does not constrain it.

• The CLI defaults to requiring the binding. --allow-missing-binding is the explicit opt-out. --require-binding is still accepted as a no-op so existing scripts keep working.
• An absent carrier and a malformed one are now reported differently. Reporting a rewritten carrier as "no binding present" hid the difference between a pack that never claimed a binding and one whose binding was overwritten.
• When the check is skipped, the reason begins with NOT VERIFIED — that string is what a reader sees next to PASS.
• README documents the default and the opt-out.

This makes the behaviour match what the README already states the tool does: "Integrity binding verification (hash verification / tamper detection)".

Tests

tests/test_binding_carrier.py — 5 cases. Three of them fail on the unpatched code and pass with this change; the other two guard against over-tightening (the intact fixture still passes, --require-binding still accepted). The existing suite passes unchanged: 11 passed.

Alternative you may prefer

Constraining the schema instead — "pattern": "^sha256:[0-9a-f]{64}$" on result_ref — would also close it, in one line. I did not take that route because it decides a protocol question that is yours: whether result_ref is always a binding digest or may be a general result reference. Happy to switch if that is the intended semantics.

---

Prepared with Claude (Opus 5); reviewed and submitted by Vitaly Reznik.